SSH Public Key Authentication

Ronnie Zownir — Wed, 27 Feb 2008 03:54:00 +0000

If you use ssh a lot, you should really take the time to learn about public key authentication. It is more secure than password based authentication and with the help of ssh-agent, there is no need to enter a passphrase on each and every login. Setup is well worth the effort. I use public key authentication to ssh into my WebFaction shell account from my Macbook. The following instructions document how I set that up.

Instructions

~/.ssh Directory Creation

User specific ssh data is stored in the ~/.ssh directory. On both the client and the server execute:

mkdir ~/.ssh
chmod 700 ~/.ssh

If the directory already exists, make sure that the permissions are set to 700 (rwx------).

Key Pair Generation

Create the key pair on the client with:

ssh-keygen -q -f ~/.ssh/id_rsa -t rsa

Enter a passphrase when asked. It should be at least 16 characters long and not your account password.

Public Half Key Dissemination

Upload id_rsa.pub to the server with:

scp ~/.ssh/id_rsa.pub username@remote-machine:~/.ssh/

Replace username and remote-machine accordingly.

The public key data must be appended into the ~/.ssh/authorized_keys file on the server:

cat ~/id_rsa.pub >> ~/.ssh/authorized_keys
chmod 600 ~/.ssh/authorized_keys
rm ~/.ssh/id_rsa.pub

SSH into Remote Machine

The first time you ssh into the remote machine from the client, execute:

ssh -o PreferredAuthentications=publickey username@remote-machine

Again, replace username and remote-machine accordingly. You will be asked to enter your passphrase.

Passphrase Tedium

Entering the private key passphrase each time you ssh into the remote machine can drive you nuts. If you are using Mac OS X 10.5 (Leopard), you have the option to save the passphrase in the Apple Keychain at the passphrase prompt. This feature isn’t available in Mac OS X 10.4 (Tiger) and lower. However, SSHKeychain gives you similar functionality. If your using another Unix-like system, check out the first resource below.

SSHKeychain Primer

I have a number of iMac G3s that I still use regularly. There is no out of the box keychain integration with Mac OS X 10.4 (Tiger), so I decided I would try out SSHKeychain. Setting up SSHKeychain was a little confusing at first, so I’ll explain the basics here.

There is nothing special about installation, although an installer is involved rather than a simple drag-and-drop action. Once installed, open up SSHKeychain from the Applications directory. Open up the Preferences dialog box. You can do this three ways. You can click “SSHKeychain” at the top left of the menubar and select “Preferences…”, click the keychain icon at the top right of the menubar and select “Preferences…”, or right click/click and hold the icon in the dock and select “Preferences…”. Select the “Environment” tab and check the “Manage (and modify) global environment variables”. (That’s what I missed at first.) Select the “SSH Keys” tab and remove the default values using the minus sign button (unless those private keys actually do exist). Select the plus sign button and enter the full path of the private key you just created. For example: /Users/username/.ssh/id_rsa. Close the Preferences dialog box, and click “Agent” and select “Add all keys…”. You can find “Agent” on the menubar or the dock menu. You will be prompted for the private key passphrase and have the option to add the passphrase to the Apple keychain. I had a problem typing in the entire passphrase in the password field. I solved this by typing it in my favorite text editor and doing a copy and paste. If you have to do this, make sure to copy meaningless text afterward. You really don’t want your passphrase to be exposed on the clipboard for any significant length of time. Before you ssh into your servers using public key authentication managed by SSHKeychain, restart your computer. It should work nicely afterward. There is much more you can do with SSHKeychain, but the aforementioned should get you going along.

Disabling Standard Password Authentication

You may want to make it so that only public key authentication can be used to login to a remote machine using ssh. Check out the second resource for more information.

Zownir Enterprises » ssh